The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The script scripts/office/unpack.py uses an unsafe method for extracting Word document archives, which are internally ZIP files.
Evidence: The script calls zf.extractall(output_path) on user-provided documents without validating that the filenames within the archive are confined to the target directory.
Risk: This vulnerability, known as 'Zip Slip', allows a malicious document to use path traversal sequences (e.g., ../../) to overwrite sensitive files or install malicious scripts outside the intended extraction path.
[METADATA_POISONING]: The skill's metadata and licensing information are deceptive regarding its origin and authorship.
Evidence: The LICENSE.txt file and multiple internal code comments claim the skill is the proprietary property of 'Anthropic, PBC', which contradicts the provided author context of razoukenni-pixel.
Risk: Impersonating a trusted entity is a common technique used to encourage users to grant high permissions or overlook suspicious behaviors during execution.
[DYNAMIC_EXECUTION]: The skill performs runtime compilation and utilizes process injection techniques.
Evidence: scripts/office/soffice.py dynamically writes a C source file to a temporary directory and compiles it using gcc to create a shared object (.so). It then uses LD_PRELOAD to inject this object into the LibreOffice process.
Evidence: scripts/accept_changes.py generates StarBasic macro XML at runtime to automate document edits through the Office suite's internal scripting engine.
Risk: While used here as a workaround for environment restrictions, runtime compilation and library injection are high-capability behaviors that can be repurposed for unauthorized code execution or persistent backdoors.
[INDIRECT_PROMPT_INJECTION]: The skill presents a significant attack surface for indirect prompt injection through document parsing.
Ingestion points: scripts/office/unpack.py extracts raw XML and pandoc is used to convert documents into text for the agent.
Boundary markers: Absent; the skill instructions do not include delimiters or warnings to treat document content as untrusted data.
Capability inventory: The skill has the ability to execute system commands, write to the file system, and compile code.
Sanitization: Absent; content extracted from Word documents is passed to the agent without filtering or sanitization of potential natural language instructions.

docx